CVE-2026-96570
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
The Schema & Structured Data for WP & AMP plugin (versions up to and including 1.67) is vulnerable to stored cross-site scripting via the 'saswp_review_text' parameter. Insufficient input sanitization and output escaping allows an unauthenticated attacker to inject arbitrary web scripts that execute when a user visits the injected page. The nonce, the only authorization gate, is publicly printed in the shortcode HTML, making it ineffective.
Risk Assessment
An unauthenticated attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft or account takeover. The risk is high because the nonce is publicly available.
Recommendation
Update the Schema & Structured Data for WP & AMP plugin to a version newer than 1.67. Consider disabling the [saswp-reviews-form] shortcode until patched.
Other vulnerabilities in Schema & Structured Data for WP & AMP WordPress plugin
Original NVD description (English source)
The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to, and including, 1.67 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce that serves as the only authorization gate is publicly printed in the [saswp-reviews-form] shortcode HTML, making it obtainable by any anonymous visitor and rendering it ineffective as an access control boundary.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS